CVE-2012-6435 in ControlLogix controllers
Summary
by MITRE
When an affected product receives a valid CIP message from an unauthorized or unintended source to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP that instructs the CPU to stop logic execution and enter a fault state, a DoS can occur. This situation could cause loss of availability and a disruption of communication with other connected devices.
Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 06/03/2026
The vulnerability identified as CVE-2012-6435 represents a critical denial of service flaw affecting Rockwell Automation EtherNet/IP communication products across multiple controller and adapter models. This vulnerability resides within the Common Industrial Protocol implementation of these industrial control systems, specifically impacting devices that utilize EtherNet/IP for communication between industrial automation components. The affected products include various 1756 and 1768 series communication modules, CompactLogix and ControlLogix controllers, FLEXLogix adapters, and other industrial networking equipment that form the backbone of industrial control systems. The flaw manifests when these devices receive specially crafted CIP (Common Industrial Protocol) messages that contain logic-execution stop and fault commands, leading to complete system outages and operational disruption.
The technical exploitation of this vulnerability occurs through the improper handling of CIP messages within the EtherNet/IP stack of Rockwell Automation devices. When a remote attacker sends a malicious CIP message containing a logic-execution stop command followed by a fault condition, the affected industrial controllers and communication modules interpret this as a legitimate system command rather than a malformed packet. This processing error causes the affected devices to halt normal operations and enter a fault state, effectively disabling control and communication functions. The vulnerability stems from inadequate input validation and message parsing within the CIP implementation, allowing attackers to manipulate the execution flow of industrial control systems. This behavior aligns with CWE-129, which addresses issues related to insufficient input validation, and represents a classic example of how industrial protocols can be exploited to cause operational disruption.
The operational impact of this vulnerability extends beyond simple system downtime, as it can lead to complete control and communication outages across industrial processes. When affected controllers and adapters experience denial of service conditions, production lines may halt unexpectedly, safety systems could fail to function properly, and critical process control operations may become unavailable. The affected devices include both legacy and newer models from Rockwell Automation, spanning from older ControlLogix 18 and earlier versions to CompactLogix 19 and earlier systems, indicating a widespread exposure across industrial automation infrastructure. This vulnerability particularly affects environments where industrial control systems are connected to corporate networks or the internet, as it allows remote exploitation without requiring physical access to the industrial equipment. The impact aligns with ATT&CK technique T1499.001, which covers network denial of service attacks, and demonstrates how industrial control systems can be targeted to cause operational disruption.
Mitigation strategies for CVE-2012-6435 should focus on network segmentation and access control measures to prevent unauthorized remote access to industrial control systems. Organizations should implement network firewalls and access control lists to restrict communication to only authorized industrial networks and prevent direct internet access to critical control equipment. The most effective long-term solution involves applying manufacturer-provided security patches and firmware updates that address the CIP message parsing vulnerability. Network administrators should also implement monitoring solutions to detect unusual CIP traffic patterns and potential exploitation attempts. Additionally, industrial control system administrators should conduct regular security assessments and vulnerability scans of their industrial networks to identify and remediate similar issues. The vulnerability highlights the importance of maintaining secure industrial protocols and implementing proper network segmentation as recommended by NIST SP 800-82 and IEC 62443 standards, which emphasize the need for robust network security controls in industrial environments.